awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 18:27:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated to enum ActionProjectType

Browse Source
This commit is contained in:
=
2025-01-14 23:26:18 +05:30
parent d721a46ec9
commit 6f38d6c76f
46 changed files with 347 additions and 350 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/schemas/models.ts
+2 -2
View File
@@ -216,11 +216,11 @@ export enum ProjectType {
SSH = "ssh"
}
export enum ProjectOperationType {
export enum ActionProjectType {
SecretManager = ProjectType.SecretManager,
CertificateManager = ProjectType.CertificateManager,
KMS = ProjectType.KMS,
SSH = ProjectType.SSH,
// project operations that happen on all types
Global = "global"
Any = "any"
}
backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts
+7 -7
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -93,7 +93,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -199,7 +199,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const accessApprovalPolicies = await accessApprovalPolicyDAL.find({ projectId: project.id, deletedAt: null });
@@ -250,7 +250,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: accessApprovalPolicy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
@@ -334,7 +334,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: policy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
@@ -385,7 +385,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!membership) {
throw new ForbiddenRequestError({ message: "You are not a member of this project" });
@@ -425,7 +425,7 @@ export const accessApprovalPolicyServiceFactory = ({
projectId: policy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
backend/src/ee/services/access-approval-request/access-approval-request-service.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import slugify from "@sindresorhus/slugify";
import ms from "ms";
import { ProjectMembershipRole, ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -106,7 +106,7 @@ export const accessApprovalRequestServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!membership) {
throw new ForbiddenRequestError({ message: "You are not a member of this project" });
@@ -280,7 +280,7 @@ export const accessApprovalRequestServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!membership) {
throw new ForbiddenRequestError({ message: "You are not a member of this project" });
@@ -326,7 +326,7 @@ export const accessApprovalRequestServiceFactory = ({
projectId: accessApprovalRequest.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!membership) {
@@ -431,7 +431,7 @@ export const accessApprovalRequestServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!membership) {
throw new ForbiddenRequestError({ message: "You are not a member of this project" });
backend/src/ee/services/audit-log/audit-log-service.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError } from "@app/lib/errors";
@@ -33,7 +33,7 @@ export const auditLogServiceFactory = ({
projectId: filter.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
} else {
backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -73,7 +73,7 @@ export const certificateAuthorityCrlServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
+6 -6
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, subject } from "@casl/ability";
import ms from "ms";
import { ProjectOperationType, SecretKeyEncoding } from "@app/db/schemas";
import { ActionProjectType, SecretKeyEncoding } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import {
@@ -73,7 +73,7 @@ export const dynamicSecretLeaseServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.Lease,
@@ -153,7 +153,7 @@ export const dynamicSecretLeaseServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.Lease,
@@ -233,7 +233,7 @@ export const dynamicSecretLeaseServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.Lease,
@@ -303,7 +303,7 @@ export const dynamicSecretLeaseServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.Lease,
@@ -346,7 +346,7 @@ export const dynamicSecretLeaseServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.Lease,
backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
+10 -10
View File
@@ -1,6 +1,6 @@
import { ForbiddenError, subject } from "@casl/ability";
import { ProjectOperationType, SecretKeyEncoding } from "@app/db/schemas";
import { ActionProjectType, SecretKeyEncoding } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import {
@@ -79,7 +79,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.CreateRootCredential,
@@ -151,7 +151,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.EditRootCredential,
@@ -235,7 +235,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.DeleteRootCredential,
@@ -296,7 +296,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.ReadRootCredential,
@@ -347,7 +347,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
// verify user has access to each env in request
@@ -391,7 +391,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.ReadRootCredential,
@@ -440,7 +440,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionDynamicSecretActions.ReadRootCredential,
@@ -472,7 +472,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const userAccessibleFolderMappings = folderMappings.filter(({ path, environment }) =>
@@ -518,7 +518,7 @@ export const dynamicSecretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
// verify user has access to each env in request
backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts
+10 -10
View File
@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
import { packRules } from "@casl/ability/extra";
import ms from "ms";
import { ProjectOperationType, TableName } from "@app/db/schemas";
import { ActionProjectType, TableName } from "@app/db/schemas";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { unpackPermissions } from "@app/server/routes/santizedSchemas/permission";
@@ -61,7 +61,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -73,7 +73,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -143,7 +143,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -155,7 +155,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -225,7 +225,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -237,7 +237,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
if (!hasRequiredPriviledges)
@@ -272,7 +272,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -307,7 +307,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -343,7 +343,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts
+9 -9
View File
@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf, subject } from "@casl/ability"
import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
import ms from "ms";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
@@ -69,7 +69,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -82,7 +82,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -152,7 +152,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -166,7 +166,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -253,7 +253,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -266,7 +266,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
if (!hasRequiredPriviledges)
@@ -312,7 +312,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -355,7 +355,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/ee/services/permission/permission-service-types.ts
+5 -5
View File
@@ -1,4 +1,4 @@
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
export type TBuildProjectPermissionDTO = {
@@ -15,7 +15,7 @@ export type TGetUserProjectPermissionArg = {
userId: string;
projectId: string;
authMethod: ActorAuthMethod;
projectOperationType: ProjectOperationType;
projectOperationType: ActionProjectType;
userOrgId?: string;
};
@@ -23,14 +23,14 @@ export type TGetIdentityProjectPermissionArg = {
identityId: string;
projectId: string;
identityOrgId?: string;
projectOperationType: ProjectOperationType;
projectOperationType: ActionProjectType;
};
export type TGetServiceTokenProjectPermissionArg = {
serviceTokenId: string;
projectId: string;
actorOrgId?: string;
projectOperationType: ProjectOperationType;
projectOperationType: ActionProjectType;
};
export type TGetProjectPermissionArg = {
@@ -39,5 +39,5 @@ export type TGetProjectPermissionArg = {
projectId: string;
actorAuthMethod: ActorAuthMethod;
actorOrgId?: string;
projectOperationType: ProjectOperationType;
projectOperationType: ActionProjectType;
};
backend/src/ee/services/permission/permission-service.ts
+4 -7
View File
@@ -4,9 +4,9 @@ import { MongoQuery } from "@ucast/mongo2js";
import handlebars from "handlebars";
import {
ActionProjectType,
OrgMembershipRole,
ProjectMembershipRole,
ProjectOperationType,
ServiceTokenScopes,
TIdentityProjectMemberships,
TProjectMemberships
@@ -227,10 +227,7 @@ export const permissionServiceFactory = ({
validateOrgSSO(authMethod, userProjectPermission.orgAuthEnforced);
if (
projectOperationType !== ProjectOperationType.Global &&
projectOperationType !== userProjectPermission.projectType
) {
if (projectOperationType !== ActionProjectType.Any && projectOperationType !== userProjectPermission.projectType) {
throw new BadRequestError({
message: `The project is of type ${userProjectPermission.projectType}. Operations of type ${projectOperationType} are not allowed.`
});
@@ -305,7 +302,7 @@ export const permissionServiceFactory = ({
}
if (
projectOperationType !== ProjectOperationType.Global &&
projectOperationType !== ActionProjectType.Any &&
projectOperationType !== identityProjectPermission.projectType
) {
throw new BadRequestError({
@@ -387,7 +384,7 @@ export const permissionServiceFactory = ({
});
}
if (projectOperationType !== ProjectOperationType.Global && projectOperationType !== serviceTokenProject.type) {
if (projectOperationType !== ActionProjectType.Any && projectOperationType !== serviceTokenProject.type) {
throw new BadRequestError({
message: `The project is of type ${serviceTokenProject.type}. Operations of type ${projectOperationType} are not allowed.`
});
backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts
+8 -8
View File
@@ -2,7 +2,7 @@ import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
import ms from "ms";
import { ProjectOperationType, TableName } from "@app/db/schemas";
import { ActionProjectType, TableName } from "@app/db/schemas";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
@@ -61,7 +61,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
const { permission: targetUserPermission } = await permissionService.getProjectPermission({
@@ -70,7 +70,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -148,7 +148,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
const { permission: targetUserPermission } = await permissionService.getProjectPermission({
@@ -157,7 +157,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
// we need to validate that the privilege given is not higher than the assigning users permission
@@ -234,7 +234,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -271,7 +271,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
@@ -298,7 +298,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
projectId: projectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
+7 -7
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import picomatch from "picomatch";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -85,7 +85,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
@@ -199,7 +199,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId: secretApprovalPolicy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretApproval);
@@ -294,7 +294,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId: sapPolicy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
@@ -334,7 +334,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
@@ -379,7 +379,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
return getSecretApprovalPolicy(projectId, environment, secretPath);
@@ -406,7 +406,7 @@ export const secretApprovalPolicyServiceFactory = ({
projectId: sapPolicy.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
+9 -9
View File
@@ -1,8 +1,8 @@
import { ForbiddenError, subject } from "@casl/ability";
import {
ActionProjectType,
ProjectMembershipRole,
ProjectOperationType,
SecretEncryptionAlgo,
SecretKeyEncoding,
SecretType,
@@ -153,7 +153,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const count = await secretApprovalRequestDAL.findProjectRequestCount(projectId, actorId);
@@ -180,7 +180,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
@@ -230,7 +230,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (
!hasRole(ProjectMembershipRole.Admin) &&
@@ -351,7 +351,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId: secretApprovalRequest.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (
!hasRole(ProjectMembershipRole.Admin) &&
@@ -418,7 +418,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId: secretApprovalRequest.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (
!hasRole(ProjectMembershipRole.Admin) &&
@@ -475,7 +475,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (
@@ -907,7 +907,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -1188,7 +1188,7 @@ export const secretApprovalRequestServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
if (!folder)
backend/src/ee/services/secret-rotation/secret-rotation-service.ts
+6 -6
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, subject } from "@casl/ability";
import Ajv from "ajv";
import { ProjectOperationType, ProjectVersion, TableName } from "@app/db/schemas";
import { ActionProjectType, ProjectVersion, TableName } from "@app/db/schemas";
import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { TProjectPermission } from "@app/lib/types";
@@ -59,7 +59,7 @@ export const secretRotationServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation);
@@ -88,7 +88,7 @@ export const secretRotationServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
@@ -197,7 +197,7 @@ export const secretRotationServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation);
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
@@ -243,7 +243,7 @@ export const secretRotationServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretRotation);
await secretRotationQueue.removeFromQueue(doc.id, doc.interval);
@@ -261,7 +261,7 @@ export const secretRotationServiceFactory = ({
projectId: doc.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts
+5 -5
View File
@@ -1,6 +1,6 @@
import { ForbiddenError, subject } from "@casl/ability";
import { ProjectOperationType, TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas";
import { ActionProjectType, TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas";
import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
import { InternalServerError, NotFoundError } from "@app/lib/errors";
import { groupBy } from "@app/lib/fn";
@@ -89,7 +89,7 @@ export const secretSnapshotServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
@@ -126,7 +126,7 @@ export const secretSnapshotServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
@@ -155,7 +155,7 @@ export const secretSnapshotServiceFactory = ({
projectId: snapshot.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
@@ -331,7 +331,7 @@ export const secretSnapshotServiceFactory = ({
projectId: snapshot.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import ms from "ms";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -60,7 +60,7 @@ export const sshCertificateTemplateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -133,7 +133,7 @@ export const sshCertificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -202,7 +202,7 @@ export const sshCertificateTemplateServiceFactory = ({
projectId: certificateTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -229,7 +229,7 @@ export const sshCertificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/ee/services/ssh/ssh-certificate-authority-service.ts
+8 -8
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
@@ -71,7 +71,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -124,7 +124,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -193,7 +193,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -232,7 +232,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -274,7 +274,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: sshCertificateTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -396,7 +396,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: sshCertificateTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -494,7 +494,7 @@ export const sshCertificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SSH
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/ee/services/trusted-ip/trusted-ip-service.ts
+5 -5
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { BadRequestError } from "@app/lib/errors";
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
import { TProjectPermission } from "@app/lib/types";
@@ -34,7 +34,7 @@ export const trustedIpServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
const trustedIps = await trustedIpDAL.find({
@@ -59,7 +59,7 @@ export const trustedIpServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
@@ -105,7 +105,7 @@ export const trustedIpServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
@@ -151,7 +151,7 @@ export const trustedIpServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.IpAllowList);
backend/src/server/routes/v1/dashboard-router.ts
+2 -2
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, subject } from "@casl/ability";
import { z } from "zod";
import { ProjectOperationType, SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
import { ActionProjectType, SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
import {
ProjectPermissionDynamicSecretActions,
@@ -226,7 +226,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
projectId,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const allowedDynamicSecretEnvironments = // filter envs user has access to
backend/src/services/certificate-authority/certificate-authority-service.ts
+14 -14
View File
@@ -5,7 +5,7 @@ import crypto, { KeyObject } from "crypto";
import ms from "ms";
import { z } from "zod";
import { ProjectOperationType, ProjectType, TCertificateAuthorities, TCertificateTemplates } from "@app/db/schemas";
import { ActionProjectType, ProjectType, TCertificateAuthorities, TCertificateTemplates } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getConfig } from "@app/lib/config/env";
@@ -142,7 +142,7 @@ export const certificateAuthorityServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -311,7 +311,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -343,7 +343,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -369,7 +369,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -395,7 +395,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -457,7 +457,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -728,7 +728,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -764,7 +764,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -845,7 +845,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -992,7 +992,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -1155,7 +1155,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates);
@@ -1484,7 +1484,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod: dto.actorAuthMethod,
actorOrgId: dto.actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -1842,7 +1842,7 @@ export const certificateAuthorityServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/services/certificate-template/certificate-template-service.ts
+8 -8
View File
@@ -2,7 +2,7 @@ import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import bcrypt from "bcrypt";
import { ProjectOperationType, TCertificateTemplateEstConfigsUpdate } from "@app/db/schemas";
import { ActionProjectType, TCertificateTemplateEstConfigsUpdate } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -73,7 +73,7 @@ export const certificateTemplateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -135,7 +135,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -193,7 +193,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -220,7 +220,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -262,7 +262,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -347,7 +347,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -429,7 +429,7 @@ export const certificateTemplateServiceFactory = ({
projectId: certTemplate.projectId,
actorAuthMethod: dto.actorAuthMethod,
actorOrgId: dto.actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/services/certificate/certificate-service.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -56,7 +56,7 @@ export const certificateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
@@ -80,7 +80,7 @@ export const certificateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
@@ -115,7 +115,7 @@ export const certificateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
@@ -162,7 +162,7 @@ export const certificateServiceFactory = ({
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
backend/src/services/cmek/cmek-service.ts
+7 -7
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType, ProjectType } from "@app/db/schemas";
import { ActionProjectType, ProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionCmekActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -40,7 +40,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Create, ProjectPermissionSub.Cmek);
@@ -66,7 +66,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId: key.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Edit, ProjectPermissionSub.Cmek);
@@ -89,7 +89,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId: key.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Delete, ProjectPermissionSub.Cmek);
@@ -115,7 +115,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
@@ -140,7 +140,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId: key.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Encrypt, ProjectPermissionSub.Cmek);
@@ -167,7 +167,7 @@ export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService, proj
projectId: key.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.KMS
projectOperationType: ActionProjectType.KMS
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Decrypt, ProjectPermissionSub.Cmek);
backend/src/services/group-project/group-project-service.ts
+6 -6
View File
@@ -1,7 +1,7 @@
import { ForbiddenError } from "@casl/ability";
import ms from "ms";
import { ProjectMembershipRole, ProjectOperationType, SecretKeyEncoding } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole, SecretKeyEncoding } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
@@ -75,7 +75,7 @@ export const groupProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Groups);
@@ -244,7 +244,7 @@ export const groupProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Groups);
@@ -347,7 +347,7 @@ export const groupProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Groups);
@@ -392,7 +392,7 @@ export const groupProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Groups);
@@ -420,7 +420,7 @@ export const groupProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Groups);
backend/src/services/identity-project/identity-project-service.ts
+7 -7
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, subject } from "@casl/ability";
import ms from "ms";
import { ProjectMembershipRole, ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
@@ -60,7 +60,7 @@ export const identityProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
@@ -166,7 +166,7 @@ export const identityProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
@@ -262,7 +262,7 @@ export const identityProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
@@ -275,7 +275,7 @@ export const identityProjectServiceFactory = ({
projectId: identityProjectMembership.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
if (!isAtLeastAsPrivileged(permission, identityRolePermission))
throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
@@ -302,7 +302,7 @@ export const identityProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Identity);
@@ -333,7 +333,7 @@ export const identityProjectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/services/integration-auth/integration-auth-service.ts
+34 -34
View File
@@ -5,7 +5,7 @@ import { Client as OctopusClient, SpaceRepository as OctopusSpaceRepository } fr
import AWS from "aws-sdk";
import {
ProjectOperationType,
ActionProjectType,
SecretEncryptionAlgo,
SecretKeyEncoding,
TIntegrationAuths,
@@ -103,7 +103,7 @@ export const integrationAuthServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const authorizations = await integrationAuthDAL.find({ projectId });
@@ -121,7 +121,7 @@ export const integrationAuthServiceFactory = ({
projectId: auth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
return permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -139,7 +139,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
return integrationAuth;
@@ -165,7 +165,7 @@ export const integrationAuthServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
@@ -275,7 +275,7 @@ export const integrationAuthServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
@@ -410,7 +410,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
@@ -672,7 +672,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -707,7 +707,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -738,7 +738,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -780,7 +780,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -809,7 +809,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -884,7 +884,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -932,7 +932,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -967,7 +967,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1026,7 +1026,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1063,7 +1063,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1105,7 +1105,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1146,7 +1146,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1187,7 +1187,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1227,7 +1227,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1268,7 +1268,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1337,7 +1337,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1412,7 +1412,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1463,7 +1463,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1512,7 +1512,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1581,7 +1581,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1623,7 +1623,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1736,7 +1736,7 @@ export const integrationAuthServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
@@ -1760,7 +1760,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
@@ -1794,7 +1794,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(sourcePermission).throwUnlessCan(
@@ -1808,7 +1808,7 @@ export const integrationAuthServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(targetPermission).throwUnlessCan(
@@ -1841,7 +1841,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
@@ -1882,7 +1882,7 @@ export const integrationAuthServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
backend/src/services/integration/integration-service.ts
+8 -8
View File
@@ -1,6 +1,6 @@
import { ForbiddenError, subject } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { NotFoundError } from "@app/lib/errors";
@@ -87,7 +87,7 @@ export const integrationServiceFactory = ({
projectId: integrationAuth.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
@@ -166,7 +166,7 @@ export const integrationServiceFactory = ({
projectId: integration.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
@@ -233,7 +233,7 @@ export const integrationServiceFactory = ({
projectId: integration.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -261,7 +261,7 @@ export const integrationServiceFactory = ({
projectId: integration.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -304,7 +304,7 @@ export const integrationServiceFactory = ({
projectId: integration.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Integrations);
@@ -341,7 +341,7 @@ export const integrationServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -361,7 +361,7 @@ export const integrationServiceFactory = ({
projectId: integration.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
backend/src/services/org/org-service.ts
+2 -2
View File
@@ -5,10 +5,10 @@ import jwt from "jsonwebtoken";
import { Knex } from "knex";
import {
ActionProjectType,
OrgMembershipRole,
OrgMembershipStatus,
ProjectMembershipRole,
ProjectOperationType,
ProjectVersion,
SecretKeyEncoding,
TableName,
@@ -780,7 +780,7 @@ export const orgServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(projectPermission).throwUnlessCan(
ProjectPermissionActions.Create,
backend/src/services/pki-alert/pki-alert-service.ts
+5 -5
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType, ProjectType } from "@app/db/schemas";
import { ActionProjectType, ProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -92,7 +92,7 @@ export const pkiAlertServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.PkiAlerts);
@@ -122,7 +122,7 @@ export const pkiAlertServiceFactory = ({
projectId: alert.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
@@ -149,7 +149,7 @@ export const pkiAlertServiceFactory = ({
projectId: alert.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiAlerts);
@@ -182,7 +182,7 @@ export const pkiAlertServiceFactory = ({
projectId: alert.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiAlerts);
backend/src/services/pki-collection/pki-collection-service.ts
+8 -8
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType, ProjectType, TPkiCollectionItems } from "@app/db/schemas";
import { ActionProjectType, ProjectType, TPkiCollectionItems } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -68,7 +68,7 @@ export const pkiCollectionServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -101,7 +101,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
@@ -126,7 +126,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiCollections);
@@ -154,7 +154,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -184,7 +184,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
@@ -228,7 +228,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -322,7 +322,7 @@ export const pkiCollectionServiceFactory = ({
projectId: pkiCollection.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.CertificateManager
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/services/project-bot/project-bot-service.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType, ProjectVersion } from "@app/db/schemas";
import { ActionProjectType, ProjectVersion } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { generateAsymmetricKeyPair } from "@app/lib/crypto";
@@ -47,7 +47,7 @@ export const projectBotServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
@@ -114,7 +114,7 @@ export const projectBotServiceFactory = ({
projectId: bot.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Integrations);
backend/src/services/project-env/project-env-service.ts
+5 -5
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -48,7 +48,7 @@ export const projectEnvServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Environments);
@@ -137,7 +137,7 @@ export const projectEnvServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Environments);
@@ -201,7 +201,7 @@ export const projectEnvServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Environments);
@@ -257,7 +257,7 @@ export const projectEnvServiceFactory = ({
projectId: environment.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Environments);
backend/src/services/project-key/project-key-service.ts
+4 -4
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError } from "@app/lib/errors";
@@ -38,7 +38,7 @@ export const projectKeyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -68,7 +68,7 @@ export const projectKeyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
const latestKey = await projectKeyDAL.findLatestProjectKey(actorId, projectId);
return latestKey;
@@ -87,7 +87,7 @@ export const projectKeyServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
return projectKeyDAL.findAllProjectUserPubKeys(projectId);
backend/src/services/project-membership/project-membership-service.ts
+8 -8
View File
@@ -2,7 +2,7 @@
import { ForbiddenError } from "@casl/ability";
import ms from "ms";
import { ProjectMembershipRole, ProjectOperationType, ProjectVersion, TableName } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole, ProjectVersion, TableName } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -84,7 +84,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
@@ -128,7 +128,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
@@ -151,7 +151,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
@@ -178,7 +178,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
const orgMembers = await orgDAL.findMembership({
@@ -259,7 +259,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
@@ -359,7 +359,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Member);
@@ -395,7 +395,7 @@ export const projectMembershipServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Member);
backend/src/services/project-role/project-role-service.ts
+7 -7
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
import { ProjectMembershipRole, ProjectOperationType, TableName } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole, TableName } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import {
ProjectPermissionActions,
@@ -64,7 +64,7 @@ export const projectRoleServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Role);
const existingRole = await projectRoleDAL.findOne({ slug: data.slug, projectId });
@@ -102,7 +102,7 @@ export const projectRoleServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
if (roleSlug !== "custom" && Object.values(ProjectMembershipRole).includes(roleSlug as ProjectMembershipRole)) {
@@ -125,7 +125,7 @@ export const projectRoleServiceFactory = ({
projectId: projectRole.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Role);
@@ -153,7 +153,7 @@ export const projectRoleServiceFactory = ({
projectId: projectRole.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Role);
@@ -195,7 +195,7 @@ export const projectRoleServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Role);
const customRoles = await projectRoleDAL.find(
@@ -218,7 +218,7 @@ export const projectRoleServiceFactory = ({
projectId,
authMethod: actorAuthMethod,
userOrgId: actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
return { permissions: packRules(permission.rules), membership };
};
backend/src/services/project/project-service.ts
+24 -24
View File
@@ -2,8 +2,8 @@ import { ForbiddenError } from "@casl/ability";
import slugify from "@sindresorhus/slugify";
import {
ActionProjectType,
ProjectMembershipRole,
ProjectOperationType,
ProjectType,
ProjectVersion,
TProjectEnvironments
@@ -439,7 +439,7 @@ export const projectServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
@@ -523,7 +523,7 @@ export const projectServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
return project;
};
@@ -537,7 +537,7 @@ export const projectServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
@@ -563,7 +563,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
@@ -592,7 +592,7 @@ export const projectServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
if (!hasRole(ProjectMembershipRole.Admin))
@@ -624,7 +624,7 @@ export const projectServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
if (!hasRole(ProjectMembershipRole.Admin)) {
@@ -657,7 +657,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
@@ -679,7 +679,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
@@ -717,7 +717,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
@@ -763,7 +763,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -814,7 +814,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
@@ -869,7 +869,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
@@ -905,7 +905,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
@@ -942,7 +942,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -973,7 +973,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -1009,7 +1009,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
@@ -1048,7 +1048,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.SSH
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -1083,7 +1083,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms);
@@ -1111,7 +1111,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms);
@@ -1141,7 +1141,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms);
@@ -1164,7 +1164,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
if (!membership) {
@@ -1197,7 +1197,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Settings);
@@ -1246,7 +1246,7 @@ export const projectServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
backend/src/services/secret-blind-index/secret-blind-index-service.ts
+4 -4
View File
@@ -1,4 +1,4 @@
import { ProjectMembershipRole, ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -37,7 +37,7 @@ export const secretBlindIndexServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const secretCount = await secretBlindIndexDAL.countOfSecretsWithNullSecretBlindIndex(projectId);
@@ -57,7 +57,7 @@ export const secretBlindIndexServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!hasRole(ProjectMembershipRole.Admin)) {
throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" });
@@ -81,7 +81,7 @@ export const secretBlindIndexServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!hasRole(ProjectMembershipRole.Admin)) {
throw new ForbiddenRequestError({ message: "Insufficient privileges, user must be admin" });
backend/src/services/secret-folder/secret-folder-service.ts
+10 -10
View File
@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
import path from "path";
import { v4 as uuidv4, validate as uuidValidate } from "uuid";
import { ProjectOperationType, TSecretFoldersInsert } from "@app/db/schemas";
import { ActionProjectType, TSecretFoldersInsert } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
@@ -58,7 +58,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -157,7 +157,7 @@ export const secretFolderServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
folders.forEach(({ environment, path: secretPath }) => {
@@ -267,7 +267,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -348,7 +348,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -405,7 +405,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const env = await projectEnvDAL.findOne({ projectId, slug: environment });
@@ -449,7 +449,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const envs = await projectEnvDAL.findBySlugs(projectId, environments);
@@ -491,7 +491,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const envs = await projectEnvDAL.findBySlugs(projectId, environments);
@@ -527,7 +527,7 @@ export const secretFolderServiceFactory = ({
projectId: folder.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(folder.projectId, [folder.id]);
@@ -556,7 +556,7 @@ export const secretFolderServiceFactory = ({
projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const envs = await projectEnvDAL.findBySlugs(projectId, environments);
backend/src/services/secret-import/secret-import-service.ts
+10 -10
View File
@@ -2,7 +2,7 @@ import path from "node:path";
import { ForbiddenError, subject } from "@casl/ability";
import { ProjectOperationType, TableName } from "@app/db/schemas";
import { ActionProjectType, TableName } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -79,7 +79,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
// check if user has permission to import into destination path
@@ -198,7 +198,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -294,7 +294,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -368,7 +368,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
// check if user has permission to import into destination path
@@ -448,7 +448,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -484,7 +484,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -534,7 +534,7 @@ export const secretImportServiceFactory = ({
projectId: folder.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -583,7 +583,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -621,7 +621,7 @@ export const secretImportServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
backend/src/services/secret-tag/secret-tag-service.ts
+7 -7
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -30,7 +30,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Tags);
@@ -62,7 +62,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId: tag.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Tags);
@@ -80,7 +80,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId: tag.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Tags);
@@ -98,7 +98,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId: tag.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
@@ -115,7 +115,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId: tag.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
@@ -129,7 +129,7 @@ export const secretTagServiceFactory = ({ secretTagDAL, permissionService }: TSe
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+16 -16
View File
@@ -1,7 +1,7 @@
import { ForbiddenError, PureAbility, subject } from "@casl/ability";
import { z } from "zod";
import { ProjectMembershipRole, ProjectOperationType, SecretsV2Schema, SecretType, TableName } from "@app/db/schemas";
import { ActionProjectType, ProjectMembershipRole, SecretsV2Schema, SecretType, TableName } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
@@ -198,7 +198,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -326,7 +326,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (inputSecret.newSecretName === "") {
@@ -515,7 +515,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -617,7 +617,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
@@ -664,7 +664,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
@@ -748,7 +748,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!isInternal) {
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
@@ -798,7 +798,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
@@ -952,7 +952,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, path);
@@ -1109,7 +1109,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -1254,7 +1254,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -1465,7 +1465,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -1577,7 +1577,7 @@ export const secretV2BridgeServiceFactory = ({
projectId: folder.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
@@ -1610,7 +1610,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!hasRole(ProjectMembershipRole.Admin))
@@ -1658,7 +1658,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const sourceFolder = await folderDAL.findBySecretPath(projectId, sourceEnvironment, sourceSecretPath);
@@ -2016,7 +2016,7 @@ export const secretV2BridgeServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
backend/src/services/secret/secret-fns.ts
+2 -2
View File
@@ -3,7 +3,7 @@ import { subject } from "@casl/ability";
import path from "path";
import {
ProjectOperationType,
ActionProjectType,
SecretEncryptionAlgo,
SecretKeyEncoding,
SecretType,
@@ -183,7 +183,7 @@ export const recursivelyGetSecretPaths = ({
projectId,
actorAuthMethod: auth.actorAuthMethod,
actorOrgId: auth.actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
// Filter out paths that the user does not have permission to access, and paths that are not in the current path
backend/src/services/secret/secret-service.ts
+16 -16
View File
@@ -3,8 +3,8 @@
import { ForbiddenError, subject } from "@casl/ability";
import {
ActionProjectType,
ProjectMembershipRole,
ProjectOperationType,
ProjectUpgradeStatus,
SecretEncryptionAlgo,
SecretKeyEncoding,
@@ -197,7 +197,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -315,7 +315,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -460,7 +460,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -557,7 +557,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
let paths: { folderId: string; path: string }[] = [];
@@ -665,7 +665,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -765,7 +765,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
@@ -852,7 +852,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -961,7 +961,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
@@ -2237,7 +2237,7 @@ export const secretServiceFactory = ({
projectId: folder.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] });
@@ -2273,7 +2273,7 @@ export const secretServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -2379,7 +2379,7 @@ export const secretServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -2486,7 +2486,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!hasRole(ProjectMembershipRole.Admin))
@@ -2571,7 +2571,7 @@ export const secretServiceFactory = ({
projectId: project.id,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(
@@ -2960,7 +2960,7 @@ export const secretServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
if (!hasRole(ProjectMembershipRole.Admin))
@@ -2989,7 +2989,7 @@ export const secretServiceFactory = ({
projectId: params.projectId,
actorAuthMethod: actor.authMethod,
actorOrgId: actor.orgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
const secrets = secretV2BridgeService.getSecretsByFolderMappings({ ...params, userId: actor.id }, permission);
backend/src/services/service-token/service-token-service.ts
+4 -4
View File
@@ -3,7 +3,7 @@ import crypto from "node:crypto";
import { ForbiddenError, subject } from "@casl/ability";
import bcrypt from "bcrypt";
import { ProjectOperationType } from "@app/db/schemas";
import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getConfig } from "@app/lib/config/env";
@@ -61,7 +61,7 @@ export const serviceTokenServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.ServiceTokens);
@@ -117,7 +117,7 @@ export const serviceTokenServiceFactory = ({
projectId: serviceToken.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.SecretManager
projectOperationType: ActionProjectType.SecretManager
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.ServiceTokens);
@@ -152,7 +152,7 @@ export const serviceTokenServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.ServiceTokens);
backend/src/services/webhook/webhook-service.ts
+6 -6
View File
@@ -1,6 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import { ProjectOperationType, TWebhooksInsert } from "@app/db/schemas";
import { ActionProjectType, TWebhooksInsert } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
@@ -51,7 +51,7 @@ export const webhookServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Webhooks);
const env = await projectEnvDAL.findOne({ projectId, slug: environment });
@@ -100,7 +100,7 @@ export const webhookServiceFactory = ({
projectId: webhook.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Webhooks);
@@ -118,7 +118,7 @@ export const webhookServiceFactory = ({
projectId: webhook.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Webhooks);
@@ -136,7 +136,7 @@ export const webhookServiceFactory = ({
projectId: webhook.projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
const project = await projectDAL.findById(webhook.projectId);
@@ -180,7 +180,7 @@ export const webhookServiceFactory = ({
projectId,
actorAuthMethod,
actorOrgId,
projectOperationType: ProjectOperationType.Global
projectOperationType: ActionProjectType.Any
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks);